This is a translation for information purposes. In case of discrepancy, the Spanish version prevails: Política de privacidad.
Last updated: 7 November 2026
In compliance with Article 13 and with the principles of lawfulness, fairness and transparency laid down in Regulation (EU) 2016/679, the General Data Protection Regulation (hereinafter, GDPR), we inform you that:
The controller of the personal data collected through the contact channels of this website, our platform or our mobile application is Francisco Javier González Martín, Spanish tax ID (NIF) 78854910P, with address at Calle San Isidro, San Matías, 18, 3º, 38108 La Laguna, Santa Cruz de Tenerife, Spain. You can contact the controller by phone at +34 624 448 296 or by email at hello@washmas.app. Hereinafter, WashMas.
For certain processing operations in the app, WashMas acts as a processor on behalf of the laundry that owns the shop, as detailed in the relevant sections.
1. Data protection information on processing carried out on the website
The personal data you provide to WashMas through this website, or through any of the contact channels it makes available to you, may be processed for the purpose corresponding to the reason for which you provided them.
Accordingly, the data provided may be used for the following purposes, depending on the reason for which you provide them:
Information requests.
- Description: to handle requests for information and to answer any enquiries you may send us.
- Legal basis: consent of the data subject, Art. 6(1)(a) GDPR.
- Retention: the data will be used solely to answer the enquiries made and will then be deleted. They will be deleted no later than 6 months after the last contact with the requesting user.
- Recipients: the data will not be disclosed to third parties unless required by law.
Requests for quotes or financial estimates.
- Description: to contact the requester, to prepare and deliver/send the quote, and to carry out follow-up and commercial prospecting by phone, online or in person.
- Legal basis: taking steps prior to entering into a contract, Art. 6(1)(b) GDPR.
- Retention: until the applicable legal periods for keeping tax and accounting data have expired.
- Recipients: the data will not be disclosed to third parties unless required by law.
Analysis of website visits through cookies.
- Purpose: management of users' browsing data and preferences.
- Legal basis: consent of the data subject, Art. 6(1)(a) GDPR.
- Retention: the data collected by cookies will be kept for the period indicated in the table of the cookie policy. The period starts when each user session on the website ends.
- Recipients: in the case of third-party cookies, the browsing data are managed by the owners of those cookies.
Contract management
- Description: to manage the sign-up, execution and performance of the service contract with laundries; to manage invoicing, collections and payments; to handle incidents and communications arising from the contractual relationship.
- Legal basis: performance of a contract or taking steps prior to entering into a contract (Art. 6(1)(b) GDPR); compliance with legal obligations, in particular tax, accounting and commercial obligations (Art. 6(1)(c) GDPR); and legitimate interest in processing the data of the laundry's contact persons and representatives (Art. 6(1)(f) GDPR).
- Retention: the data will be kept for as long as the contractual relationship lasts and, once it has ended, for the limitation periods of the legal obligations and of any liabilities arising from the contract.
- Recipients: the data will not be disclosed to third parties, except where required by law (tax authorities, judges and courts) and to the financial institutions or payment gateways needed to manage collections.
Sending of informative communications
- Description: to send, by electronic means, informative and commercial communications about WashMas's services, news, platform improvements and promotions.
- Legal basis: consent of the data subject (Art. 6(1)(a) GDPR and Art. 21 LSSI), which may be withdrawn at any time. In the case of WashMas customers, the communications may be based on the controller's legitimate interest.
- Retention: the data will be kept until the data subject withdraws consent or objects to the processing, and will then be blocked for the limitation periods of any liabilities.
- Recipients: the data will not be disclosed to third parties unless required by law.
User registration
- Description: to manage the sign-up, identification and authentication of users on the dashboard; to assign and manage access profiles and permissions; to provide the platform's services and ensure the security of access.
- Legal basis: performance of a contract (Art. 6(1)(b) GDPR) with respect to the person who registers or the account holder; and legitimate interest (Art. 6(1)(f) GDPR) in processing the data of the users designated by the laundry (managers, staff who collect the cash, etc.) in order to manage access to the platform and ensure its security.
- Retention: the data will be kept for as long as the account remains active. After the account is closed, they will be blocked for the limitation periods of legal liabilities and then erased.
You can delete your account at any time with the “Delete my account” button. When you do so, we delete your profile immediately and unlink your payment history from you, so that it can no longer be associated with you. Some payment data, no longer linked to you, must be kept for the periods required by the applicable tax and accounting rules (Art. 6(1)(c) GDPR). Exceptionally, if there is a claim, dispute or proceeding in progress relating to you, we will keep the data linked to you that are strictly necessary for the establishment, exercise or defence of legal claims (Arts. 6(1)(f) and 17(3)(e) GDPR). In that case, we will keep them blocked, available exclusively to judges and courts, the Public Prosecutor's Office and the competent public administrations, for as long as the proceeding lasts and for the limitation period of the liabilities (Art. 32 LOPDGDD). After that, we will delete them permanently.
- Recipients: the data will not be disclosed to third parties unless required by law. The data of designated users will be accessible to the holder of the laundry's account, depending on the profile.
Demo requests
- Description: to handle the request for a demonstration of the platform; to contact the person concerned to arrange and carry out the demo; and to carry out the commercial follow-up of the request.
- Legal basis: taking steps prior to entering into a contract at the request of the data subject (Art. 6(1)(b) GDPR); and consent of the data subject (Art. 6(1)(a) GDPR) for sending subsequent commercial communications, if requested through a specific, unticked checkbox.
- Retention: the data will be kept for the time needed to handle the request and, if no contract is signed, for a maximum of 1 year from the last contact, unless consent to commercial communications has been given, in which case until it is withdrawn. If a contract is signed, the data will move to the contract management processing.
- Recipients: the data will not be disclosed to third parties unless required by law.
Customer service.
- Description: management of the data provided through the chat made available to you for customer service or sales support.
- Legal basis: consent of the data subject, Art. 6(1)(a) GDPR; or performance of a contract or taking steps prior to entering into a contract, as the case may be, Art. 6(1)(b) GDPR.
- Retention: for pre-contractual enquiries, the data will be used solely to answer the enquiries made and will then be deleted. For after-sales service, the data may be stored until the obligations undertaken between the parties have ended.
- Recipients: the data will not be disclosed to third parties unless required by law.
- International data transfer: due to the use of WhatsApp as an instant messaging tool. More information in section 6 of this policy.
Technical support and incident management
- Description: to handle, record and resolve the technical enquiries and incidents of platform users, and to follow them up until they are closed.
- Legal basis: performance of the service contract (Art. 6(1)(b) GDPR) and, in the case of contact persons or users designated by the laundry, legitimate interest in handling incidents of the contracted service (Art. 6(1)(f) GDPR).
- Retention: the data will be kept for as long as the contractual relationship lasts and then blocked for the limitation periods of the liabilities arising from the service.
- Recipients: the data will not be disclosed to third parties unless required by law.
Security and access logs
- Description: to log users' access and activity on the dashboard in order to ensure the security of the platform, detect unauthorised access or misuse, investigate security incidents and be able to evidence the operations carried out.
- Legal basis: legitimate interest of WashMas in ensuring the security of its systems and of the data processed (Art. 6(1)(f) GDPR, Art. 32 GDPR) and, where applicable, compliance with legal obligations on security and personal data breach notification (Art. 6(1)(c) GDPR, Arts. 33 and 34 GDPR).
- Retention: the logs will be kept for a period of between 6 and 12 months and, in the event of an incident, for the time needed to investigate it and for any liabilities.
- Recipients: the data will not be disclosed to third parties, except where required by law (authorities, judges and courts).
2. Processing of data collected through forms, channels or documents that refer to the WashMas privacy policy
Purposes of the processing. The personal data collected in the various documents, channels or forms that refer to this privacy policy, as extended data protection information, may be processed for the applicable purpose, depending on which of the following cases applies:
Invoicing.
- Purpose: to manage the contractual or pre-contractual relationship between you and WashMas, and its administrative, tax and accounting management.
- Legal basis: performance of a contract or taking steps prior to entering into a contract, Art. 6(1)(b) GDPR.
- Retention: for the time required by the civil, financial and tax legislation in force.
- Recipients: the data may be disclosed to the competent public administrations and to banks and savings banks, as appropriate.
Management of quotes, offers and projects.
- Purpose: to prepare and deliver/send the quote, and to carry out follow-up and commercial prospecting by phone, online or in person.
- Legal basis: consent of the data subject, and taking steps at your request prior to entering into a contract, Art. 6(1)(b) GDPR.
- Retention: for the time required by the civil, financial and tax legislation in force. The period starts when the management of the quote ends.
- Recipients: the data will not be disclosed to third parties unless required by law.
Receipt of CVs.
- Purpose: to manage your job application and to consider you in recruitment processes.
- Legal basis: consent of the data subject, Art. 6(1)(a) GDPR.
- Retention: the data will be kept for a maximum of 2 years.
- Recipients: the data will not be disclosed to third parties unless required by law.
Management of email and contacts.
- Purposes: to handle occasional requests for information by email or phone; to manage the contact list; performance of contracts or pre-contractual steps.
- Legal basis: consent of the data subject in the case of requests for information or enquiries (Art. 6(1)(a) GDPR), taking steps prior to entering into a contract or performance of a contract (Art. 6(1)(b) GDPR), and legitimate interest in processing the data of contact persons (Art. 6(1)(f) GDPR).
- Retention: the data will be kept for as long as they are needed to comply with the legal obligations arising from the existing relationship. Once those obligations have ended, the data will be deleted.
- Recipients: the data will not be disclosed to third parties unless required by law.
Sending of informative emails.
- Purposes: to send you information about events and activities, offers, promotions and other commercial actions, blog posts and other information of interest about WashMas.
- Legal basis: as the case may be:
- Consent of the data subject, Art. 6(1)(a) GDPR, where you have given it through one of our contact forms or through the website.
- In the case of WashMas customers, sending advertising information is based on the controller's legitimate interest under Article 21.2 of the LSSI (Law 34/2002).
- Retention: until you request their erasure or unsubscribe from the advertising information service.
- Recipients: the data will not be disclosed to third parties unless required by law.
Contracts (data of contact persons and signatories).
- Purpose: the personal data of the signatories of contracts, where they are natural persons, or of the representatives of a legal person, will be processed in order to execute the contract and carry it out. The data of the parties' employees will also be processed for the latter purpose.
- Legal basis: performance of a contract, Art. 6(1)(b) GDPR, and legitimate interest of WashMas in processing the data of contact persons under Art. 19 of the LOPD (Organic Law 3/2018).
- Retention: for the time required by the civil, commercial, financial and tax legislation in force.
- Recipients: the data will not be disclosed to third parties unless required by law.
Handling of GDPR rights requests
- Purpose: to handle requests to exercise the rights of access, rectification, erasure, objection, restriction, portability and not to be subject to automated individual decision-making, and to keep a record of how they were handled.
- Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR, Arts. 12 to 22 GDPR and Arts. 12 et seq. LOPDGDD).
- Retention: the request and our reply will be kept for the limitation periods of any liabilities.
- Recipients: the data will not be disclosed to third parties unless required by law. They may be disclosed to the Spanish Data Protection Agency (AEPD) if the data subject lodges a complaint.
3. Data protection information on processing carried out in the app
WashMas is the controller of the data of the app user account, the technical payment log, error reports and its own commercial communications. The owner of the shop where the service is used (the laundry) is the controller of the data arising from its relationship with you as a customer of that shop (payments, use of the machines, prizes and promotions of the shop); in those cases, WashMas acts as processor, on behalf of the owner and following its instructions.
WashMas does not collect or hold users' money. Each laundry has its own Redsys virtual POS and the payment is credited directly to the owner's account. Cash paid at the kiosk is also collected by the owner.
Accordingly, the data provided may be used for the following purposes, depending on the reason for which you provide them:
App user account
- Purpose: to manage the sign-up, identification and access to your account.
- Legal basis: performance of a contract or taking steps prior to entering into a contract, namely performance of the app's terms of use (Art. 6(1)(b) GDPR).
- Retention: until you delete your account. You can delete your account at any time with the “Delete my account” button. When you do so, we delete your profile immediately and unlink your payment history from you, so that it can no longer be associated with you. Some payment data, no longer linked to you, must be kept for the periods required by the applicable tax and accounting rules (Art. 6(1)(c) GDPR). Exceptionally, if there is a claim, dispute or proceeding in progress relating to you, we will keep the data linked to you that are strictly necessary for the establishment, exercise or defence of legal claims (Arts. 6(1)(f) and 17(3)(e) GDPR). In that case, we will keep them blocked, available exclusively to judges and courts, the Public Prosecutor's Office and the competent public administrations, for as long as the proceeding lasts and for the limitation period of the liabilities (Art. 32 LOPDGDD). After that, we will delete them permanently.
- Recipients: hosting, access and email providers (see the section on providers).
Payment, technical log and use of the machines
- Purpose: a) to log the steps of each payment (QR code scanned, machine, payment method chosen and errors) in order to detect and fix faults. This log does not include the user, IP address or card; b) WashMas will act as processor with regard to initiating and confirming the payment by QR code, recording the machine used, the amount, the payment method chosen, the date and time, and managing the use of the machines.
- Legal basis: performance of a contract or taking steps prior to entering into a contract, namely performance of the app's terms of use (Art. 6(1)(b) GDPR).
- Retention: a) it is deleted automatically after 30 days; b) for the legal periods applicable to the owner. If you delete your account, the payments are unlinked from you.
- Recipients: the shop owner, the payment gateway (Redsys/Comercia) and public administrations where required by law. Card data are processed only by the gateway; WashMas has no access to them.
Push notifications
- Purpose: to send you the notifications you turn on.
- Legal basis: provision of the service you request (Art. 6(1)(b) GDPR).
- Retention: the identifier is deleted when you log out, turn off notifications or delete your account.
- Recipients: notifications are sent through Expo and Google (Android) or Apple (iOS). We store the device identifier for notifications, the user, the platform and the language. End-of-wash reminders are scheduled by your own phone, without going through our servers.
Error and stability reports
- Purpose: to log app errors through Sentry, with servers in the European Union (Germany), without email or IP address and only with the type of device or browser. If you tap “Send to WashMás” to report a fault, the report includes your internal identifier (never your email) so that we can assist you.
- Legal basis: legitimate interest in the stability and security of the app (Art. 6(1)(f) GDPR) and, for the voluntary report, handling your request (Art. 6(1)(b) GDPR).
- Retention: for the time needed for the purpose for which the data were collected.
- Recipients: app errors are logged through Sentry, with servers in the European Union (Germany), without email or IP address and only with the type of device or browser.
4. Third-party data
If, in your communications with WashMas, you provide data of third parties, we inform you that:
- You may only provide us with data of third parties if you have their express consent. Therefore, by sending us data of third parties, you declare that you have that consent, or that you have the legal capacity to give that consent on their behalf.
- All the persons whose data you send us must be aware of the content of this section. You declare that you have informed them of its content.
- WashMas accepts no liability if the user who fills in the forms or requests does not comply with the points above.
5. Optional nature of completing forms and accuracy of the data provided
The forms made available to you ask for all the data needed to handle your enquiry or request, so it is essential that you complete all the fields. If you do not complete them, we will not be able to handle your request properly.
6. International data transfers
WashMas uses services which, because of the location of the servers where they host the information or of their headquarters, are considered by the EU to involve an international transfer of data to countries outside the European Union.
This sounds complex, but it is in fact an everyday action for any company or person using social networks, cloud applications, email from the big tech companies, etc. In the context of this clarification, we inform you that WashMas makes the following international data transfers when it uses:
Social networks: if you consent to the publication of your personal data on the social network profiles where WashMas has corporate profiles, you authorise the international transfer of data to the USA. We recommend that you visit the privacy sections of the social networks mentioned in the consents.
This consent may be withdrawn at any time.
WhatsApp: we use WhatsApp as an instant messaging platform for our sales management, customer service, incident resolution and similar purposes. The use of this platform involves an international data transfer. More information: https://www.whatsapp.com/legal/privacy-policy
Supabase: database, access and functions. Although its servers are located in Ireland, the company is headquartered in the United States. More information: https://supabase.com/privacy
Cloudflare: website, DNS, protection, cookieless web analytics and email forwarding. More information: https://www.cloudflare.com/privacypolicy/
Expo: publishing and updating the app, and sending notifications. More information: https://expo.dev/privacy
Google and Apple: delivery of notifications; sign-in with Google and Apple. More information: https://policies.google.com/privacy?hl=en and https://www.apple.com/legal/privacy/
Resend: platform emails. Although its servers are located in Ireland, its headquarters are in the United States. More information: https://resend.com/legal/privacy-policy
Anthropic: programming assistant with read access to the database. More information: https://www.anthropic.com/legal/privacy
7. Users' rights
Consent and withdrawal
Users may withdraw the consents given at any time, without affecting the lawfulness of the processing carried out on the basis of that consent before its withdrawal.
Rights of access, rectification, erasure, restriction, objection and portability.
Users or visitors may request to exercise their rights of access, rectification or erasure and, in certain cases, where applicable, the restriction of processing or portability of their data, or object to their processing. All of this in accordance with the data protection legislation mentioned above.
You can exercise your data protection rights by sending your request to WashMas by email to hello@washmas.app, or to the contact address given at the beginning of this document. If you wish, you can use the forms available from the Spanish Data Protection Agency (AEPD), or ask us for a copy of them by email.
Requests to exercise rights made by users will be handled within a maximum of one month. If you do not agree with the reply given, you may lodge a complaint with the aforementioned supervisory authority. You may exercise the rights granted to you by the GDPR at any time.
WashMas is committed to respecting and defending the right to the protection of the personal data of its users, visitors and customers.